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Foreword 



id , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



The present document defines the IM Services Identity Module (ISIM) application. This application resides on the 
UICC, an IC card specified in TS 31.101 [3], In particular, TS 31.101 [3] specifies the application independent 
properties of the UlCC/terminal interface such as the physical characteristics and the logical structure. 

TS 31.101 [3] is one of the core documents for this specification and is therefore referenced in many places in the 
present document. 
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1 Scope 

The present document defines the ISIM application for access to IMS services. 
The present document specifies: 

specific command parameters; 

file structures; 

contents of EFs (Elementary Files); 

security functions; 

application protocol to be used on the interface between UICC (ISIM) and Terminal. 

This is to ensure interoperability between an ISIM and Terminal independently of the respective manufacturer, card 
issuer or operator. 

The present document does not define any aspects related to the administrative management phase of the ISIM. Any 
internal technical realisation of either the ISIM or the Terminal is only specified where these are reflected over the 
interface. The present document does not specify any of the security algorithms that may be used. 

2 References 

The following documents contain provisions that, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication and/or edition number or version number) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[I] 3GPP TS 21.1 1 1: "USIM and IC Card Requirements". 

[2] 3GPP TS 31.102: "Characteristics of the USIM Application". 

[3] 3GPP TS 31.101: "UICC -Terminal Interface, Physical and Logical Characteristics". 

[4] 3GPP TS 33.102: "3G Security; Security Architecture". 

[5] 3GPP TS 33.103: "3G Security; Integration Guidelines". 

[6] ISO/IEC 7816-4: "Identification cards - Integrated circuit cards,Part 4: Organization, security and 

commands for interchange". 

[7] Void. 

[8] Void. 

[9] 3GPP TS 23.003: "Numbering, Addressing and Identification". 

[10] Void. 

[II] Void. 

[12] 3GPP TS 25.101: "UE Radio Transmission and Reception (FDD)". 

[13] 3GPP TS 23.228: "IP Multimedia Subsystem (IMS); Stage 2". 
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[14] 3GPP TS 33.203: "3G security; Access security for IP-based services". 

[15] 3GPP TS 24.228: "Signalling flows for the IP multimedia call control based on SIP and SDP; 

Stage 3". 

[16] IETF RFC 3261: "SIP: Session Initiation Protocol". 

[17] 3GPP TS 23.038: "Alphabets and language-specific information". 

[18] ISO 639 (1988): "Code for the representation of names of languages". 

[19] 3GPPTS51.011 Release4: "Specification of the Subscriber Identity Module - Mobile Equipment 

(SIM-ME) interface". 

[20] ISO/TEC 8825(1990): "Information technology - Open Systems Interconnection - Specification of 

Basic Encoding Rules for Abstract Syntax Notation One (ASN.l)" Second Edition. 

[21] 3GPP TS 22.101: "Service aspects; Service principles". 

[22] Void. 

[23] ETSI TS 101 220: "Smart cards; ETSI numbering system for telecommunication application 

providers". 

[24] IETF RFC 2486: "The Network Access Identifier" . 

[25] 3GPP TS 33.220: "Generic Authentication Architecture (GAA); Generic bootstrapping 

architecture". 

[26] IETF RFC 2617: "HTTP Authentication: Basic and Digest Access Authentication". 

( http://www.ietf.org/rfc/rfc2617.txt ) 

[27] IETF RFC 3629 (2003): "UTF-8, a transformation format of ISO 10646". 

[28] 3GPP TS 33. 1 10: "Key establishment between a Universal Integrated Circuit Card (UICC) and a 

terminal" . 

[29] 3GPP TS 23.040: "Technical realization of the Short Message Service (SMS)". 

[30] 3GPP TS 24.01 1 : "Point-to-Point (PP) Short Message Service (SMS) support on mobile radio 

interface". 



3 Definitions, symbols, abbreviations and coding 

conventions 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

ISIM: application residing on the UICC, an IC card specified in TS 31.101 [3] 

In particular, TS 31.101 [3] specifies the application independent properties of the UlCC/terminal interface such as the 

physical characteristics and the logical structure 

The AID of ISIM is defined in ETSI TS 101 220 [23] and is stored in EF Dm . 

ADM: access condition to an EF which is under the control of the authority which creates this file 
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3.2 Symbols 



For the purposes of the present document, the following symbols apply: 



fl 
fl* 

17 
O 
f4 
f5 



Concatenation 

Exclusive or 

Message authentication function used to compute MAC 

A message authentication code (MAC) function with the property that no valuable information can 

be inferred from the function values of fl * about those of fl, ... , f5 and vice versa 

Message authentication function used to compute RES and XRES 

Key generating function used to compute CK 

Key generating function used to compute IK 

Key generating function used to compute AK 



3.3 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

3GPP 3 r Generation Partnership Project 

AC Access Condition 

ADF Application Dedicated File 

AID Application IDentifier 

AK Anonymity Key 

AKA Authentication and Key Agreement 

ALW ALWays 

AMF Authentication Management Field 

ASN. 1 Abstract Syntax Notation One 

AuC Authentication Centre 

AUTN Authentication TokeN 

BER-TLV Basic Encoding Rule - TLV 

B-TID Bootstrapping Transaction IDentifier 

CK Cipher Key 

DF Dedicated File 

EF Elementary File 

FFS For Further Study 

FQDN Fully Qualified Domain Name 

HE Home Environment 

HN Home Network 

ICC Integrated Circuit Card 

ID IDentifier 

IK Integrity Key 

IM IP Multimedia 

IMPI IM Private Identity 

IMPU IM PUblic identity 

IMS IP Multimedia Subsystem 

ISIM IM Services Identity Module 

K long-term secret Key shared between the ISIM and the AuC 

KSI Key Set Identifier 

LI Language Indication 

LSB Least Significant Bit 

MAC Message Authentication Code 

MF Master File 

MSB Most Significant Bit 

NAI Network Access Identifier 

NEV NEVer 

PIN Personal Identification Number 

PL Preferred Languages 

PS_DO PIN Status Data Object 

RAND RANDom challenge 

RES user RESponse 

RFU Reserved for Future Use 
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RST 


ReSeT 


SDP 


Session Description Protocol 


SFI 


Short EF Identifier 


SIP 


Session Initiation Protocol 


SQN 


SeQuence Number 


SW 


Status Word 


TLV 


Tag Length Value 


UE 


User Equipment 



XRES 



eXpected user RESponse 



3.4 Coding Conventions 

The following coding conventions apply to the present document. 

All lengths are presented in bytes, unless otherwise stated. Each byte is represented by bits b8 to bl, where b8 is the 
most significant bit (MSB) and bl is the least significant bit (LSB). In each representation, the leftmost bit is the MSB. 

The coding of Data Objects in the present document is according to TS 31.101 [3], 



'XX': 



Single quotes indicate hexadecimal values. Valid elements for hexadecimal values are the numbers 
'0' to '9' and 'A' to T". 



Files 



This clause specifies the EFs for the IMS session defining access conditions, data items and coding. A data item is a 
part of an EF which represents a complete logical entity. 

For an overview containing all files see figure 4.1. 



4.1 



Contents of the EFs at the MF level 



There are four EFs at the Master File (MF) level. These EFs are specified in TS 31.101 [3]. 

4.2 Contents of files at the ISIM ADF (Application DF) level 

The EFs in the ISIM ADF contain service and network related information and are required for UE to operate in an IP 
Multimedia Subsystem. 

The File IDs '6F1X' (for EFs), '5F1X' and '5F2X' (for DFs) with X ranging from '0' to 'F' are reserved under the ISIM 
ADF for administrative use by the card issuer. 



4.2.1 



Void 
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4.2.2 EFimpi (IMS private user identity) 

This EF contains the private user identity of the user. 



Identifier: '6F02' Structure: transparent Mandatory 


SFI:"02" 




File size: X bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 toX 


NAI TLV data object 


M 


X bytes 



- NAI 

Contents: 

Private user identity of the user. 

Coding: 

For contents and syntax of NAI TLV data object values see IETF RFC 2486 [24]. The NAI shall be encoded 
to an octet string according to UTF-8 encoding rules as specified in IETF RFC 3629 [27]. The tag value of 
the NAI TLV data object shall be '80'. 

4.2.3 EF D omain (Home Network Domain Name) 

This EF contains the home operator's network domain name. 



Identifier: '6F03' 


Structure: transparent 


Mandatory 


SFI:"05" 




File size: X bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 toX 


Home Network Domain Name TLV data object 


M 


X bytes 



URI 

Contents: 

Home Network Domain Name. 

Coding: 

For contents and syntax of Home Network Domain Name TLV data object values see TS 23.003 [9]. The 
Home Network Domain Name, i.e. FQDN shall be encoded to an octet string according to UTF-8 encoding 
rules as specified in IETF RFC 3629 [27]. The tag value of the Home Network Domain Name TLV data 
object shall be '80'. 
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4.2.4 EF| M pu (IMS public user identity) 



This EF contains one or more records, with each record able to hold a public SIP Identity (SIP URI) of the user. The 
first (or only) record in the EF shall be used when performing emergency registration; oras the default SIP Identity in 
case that no record is explicitly selected either in the current session or as a carryover from a prior session. 



Identifier: '6F04' Structure: linear fixed Mandatory 


SFI:"04" 




Record length: X bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 toX 


URI TLV data object 


M 


X bytes 



- URI 

Contents: 

SIP URI by which other parties know the subscriber. 

Coding: 

For contents and syntax of URI TLV data object values see IETF RFC 3261 [16]. The URI shall be encoded 
to an octet string according to UTF-8 encoding rules as specified in IETF RFC 3629 [27]. The tag value of 
the URI TLV data object shall be '80'. 

4.2.5 EF AD (Administrative Data) 

This EF contains information concerning the mode of operation according to the type of ISIM, such as normal (to be 
used by IMS subscribers for IMS operations), type approval (to allow specific use of the Terminal during type approval 
procedures of e.g. the network equipment), manufacturer specific (to allow the Terminal manufacturer to perform 
specific proprietary auto-test in its Terminal during e.g. maintenance phases). 

It also provides an indication of whether some Terminal features should be activated during normal operation. 



Identifier: '6FAD' | 


Structure 


transparent 


| 


Mandatory 


SFI: '03' 




File size: 3+X bytes 




Update activity 


low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALW 
ADM 

ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


UE operation mode 


M 


1 byte 


2 to 3 


Additional information 


M 


2 bytes 


4 to 3+X 


RFU 


O 


X bytes 



UE operation mode: 
Contents: 

mode of operation for the UE 
Coding: 

Initial value 
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- '00' normal operation. 

'80' type approval operations. 
'01' normal operation + specific facilities. 
'81' type approval operations + specific facilities. 
'02' maintenance (off line). 
Additional information: 
Coding: 

specific facilities (if bl=l in byte 1); 

Bytes 2 and 3 (first byte of additional information): 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



RFU (see TS 31.101) 



4.2.6 EF A rr (Access Rule Reference) 



This EF contains the access rules for files located under the ISIM ADF in the UICC. If the security attribute tag '8B' is 
indicated in the FCP it contains a reference to a record in this file. 

Structure of EF A rr at ADF-level 



Identifier: '6F06' 


| 


Structure: 


Linear fixed I Mandatory 


SFI: '06' 




Record Length: 


X bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




ALW 
ADM 
ADM 
ADM 




Bytes 


Description 


M/O 


Length 


1 toX 


Access Rule TLV data objects 


M 


X bytes 



This EF contains one or more records containing access rule information according to the reference to expanded format 
as defined in ISO/IEC 7816-4 [6], Each record represents an access rule. Unused bytes in the record are set to FF'. 

If the card cannot access EF ARR , any attempt to access a file with access rules indicated in this EF ARR shall not be 
granted. 
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4.2.7 EFist (ISIM Service Table) 



This EF indicates which optional services are available. If a service is not indicated as available in the ISIM, the ME 
shall not select this service. The presence of this file is mandatory if optional services are provided in the ISIM. 



Identifier: '6F07' | Structure: transparent I Optional 


SFI: '07 




File size: X bytes, X >= 1 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Services n°1 to n°8 


M 


1 byte 


2 


Services n°9 to n°16 


O 


1 byte 


3 


Services n°17 to n°24 


O 


1 byte 


4 


Services n°25to n°32 


O 


1 byte 


etc. 








X 


Services n°(8X-7) to n°(8X) 


O 


1 byte 



Services 




Contents: 


Service n°1 




Service n°2 




Service n°3 




Service n°4 




Service n°5 




Service n°6 




Service n°7 




Service n°8 



P-CSCF address 

Generic Bootstrapping Architecture (GBA) 

HTTP Digest 

GBA-based Local Key Establishment Mechanism 

Support of P-CSCF discovery for IMS Local Break Out 

Short Message Storage (SMS) 

Short Message Status Reports (SMSR) 

Support for SM-over-IP 



The EF shall contain at least one byte. Further bytes may be included, but if the EF includes an optional byte, then it is 
mandatory for the EF to also contain all bytes before that byte. Other services are possible in the future and will be 
coded on further bytes in the EF. The coding falls under the responsibility of the 3GPP. 

Coding: 

1 bit is used to code each service: 
bit = 1 : service available; 
bit = 0: service not available. 

Service available means that the ISIM has the capability to support the service and that the service is available 
for the user of the ISIM. 

Service not available means that the service shall not be used by the ISIM user, even if the ISIM has the 
capability to support the service. 

First byte: 



b8 b7 b6 B5 b4 b3 b2 bl 



Service n°l 
Service n°2 
Service n°3 
Service n°4 
Service n°5 
Service n°6 
Service n°7 
Service n°8 



Second byte: 
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b8 b7 b6 B5 b4 b3 b2 bl 



Service n°9 
Service n°10 
Service n°ll 
Service n°12 
Service n°13 
Service n°14 
Service n°15 
Service n°16 



etc. 

4.2.8 EF p .cscf (P-CSCF Address) 

If service n°l and/or service n°5 is "available", this file shall be present. 

A UE supporting IMS Local Breakout shall use this EF only if EF IS t indicates that service n°5 is "available". 

This EF contains one or more Proxy Call Session Control Function addresses. The first record in the EF shall be 
considered to be of the highest priority. The last record in the EF shall be considered to be the lowest priority. 



Identifier: '6F09' 


Structure: 


linear fixed 




Optional 






Record length: 


X bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 toX 


P-CSCF Address 


TLV data object 




M 


X bytes 



P-CSCF 



Contents: 

Address of Proxy Call Session Control Function, in the format of a FQDN, an IPv4 address, or an IPv6 
address. 

Coding: 

The tag value of this P-CSCF address TLV data object shall be '80'. The format of the data object is as 
follows: 



Field 


Length (bytes) 


Tag 


1 


Length 


1 


Address Type 


1 


P-CSCF Address 


Address Length 



Address Type: Type of the P-CSCF address. 

This field shall be set to the type of the P-CSCF address according to the following: 
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Value 


Name 


0x00 


FQDN 


0x01 


IPv4 


0x02 


IPv6 


All other values are 
reserved 





P-CSCF Address: Address of the Proxy Call Session Control Function 

This field shall be set to the address of the Proxy Call Session Control Function. When the P- 
SCSF type is set to 0x00, the corresponding P-CSCF Address shall be encoded to an octet string 
according to UTF-8 encoding rules as specified in IETF RFC 3629 [27]. 

Unused bytes shall be set to 'FF'. 

4.2.9 EF G babp (GBA Bootstrapping parameters) 

If service n°2 is "available", this file shall be present. 

This EF contains the AKA Random challenge (RAND) and Bootstrapping Transaction Identifier (B-TID) associated 
with a GBA bootstrapping procedure. 



Identifier: '6FD5'| | Structure: transparent I 


Optional 


File length: L+X+N+3 bytes Update activity: 


low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Length of RAND (16) 


M 


1 byte 


2to(X+1) 


RAND 


M 


X bytes 


X+2 


Length of B-TID (L) 


M 


1 byte 


(X+3) to (X+2+L) 


B-TID 


M 


L bytes 


X+L+3 


Length of key lifetime 


M 


1 byte 


(X+L+4) to 
(X+L+N+3) 


Key lifetime 


M 


N bytes 



Length of RAND 

Contents: number of bytes, not including this length byte, of RAND field 

RAND 

Contents: Random challenge used in the GBA_U bootstrapping procedure. 
Coding: as defined in TS 33.103 [13]. 

Length of B-TID 

Contents: number of bytes, not including this length byte, of B-TID field 

B-TID 

Content: Bootstrapping Transaction Identifier the GBA_U bootstrapped keys 
Coding: As defined in TS 33.220 [25] 

Length of key lifetime 

Contents: number of bytes, not including this length byte, of key lifetime field 

Key lifetime 

Content: Lifetime of the GBA_U bootstrapped keys 

Coding: As defined in TS 33.220 [25] 
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4.2.10 EFqbanl (GBA NAF List) 

If service n°2 is "available", this file shall be present. 

This EF contains the list of NAF_ID and B-TID associated to a GBA NAF derivation procedure. 



Identifier: '6FD7' | Structure: Linear 


fixed 


| 


Optional 


Record length: Z bytes 


Update activity: 


ow 


Access Conditions: 

READ PIN 

UPDATE ADM 

DEACTIVATEADM 

ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 toZ 


NAF Key Identifier TLV objects 


M 


Z bytes 



NAF Key Identifier tags 



Description 


Tag Value 


NAF ID Tag 


'80' 


B-TID Tag 


'81' 



NAF Key Identifier information 



Description 


Value 


M/O 


Length (bytes) 


NAF ID Tag 


'80' 


M 


1 


Length 


X 


M 


Note 


NAF ID value 


- 


M 


X 


B-TID Tag 


'81' 


M 


1 


Length 


Y 


M 


Note 


B-TID value 


- 


M 


Y 


NOTE: The length is coded according to ISO/IEC 8825 [20] 





- NAF_ID Tag '80' 
Contents: 

Identifier of Network Application Function used in the GB A_U NAF Derivation procedure. 
Coding: 

- As defined in TS 33.220 [25] 

- B-TID Tag '81' 
Content: 

Bootstrapping Transaction Identifier of the GB A_U bootstrapped key 
Coding: 

- As defined in TS 33.220 [25] 
Unused bytes shall be set to 'FF' 



4.2.11 EF 



NAFKCA 



(NAF Key Centre Address) 



If service n°2 and service n°4 are "available", this file shall be present. 

This EF contains one or more NAF Key Centre addresses. The first record in the EF shall be considered to be of the 
highest priority. The last record in the EF shall be considered to be the lowest priority. 
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Identifier: '6FDD' 


| 


Structure: 


Linear fixed j 


Optional 


Record length 


: Z bytes 


| 


Update activity: 


ow 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 toZ 


NAF 


<ey Centre 


TLV object 




M 


Z bytes 



Unused bytes shall be set to 'FF'. 
NAF Key Centre tags 



Description 


Tag Value 


NAF Key Centre address Tag 


'80' 



NAF Key Centre information 



Description 


Value 


M/O 


Length (bytes) 


NAF Key Centre address Tag 


'80' 


M 


1 


Length 


X 


M 


Note 


NAF Key Centre address value 


- 


M 


X 


Note: The length is coded according to ISO/IEC 8825 [20] 





- NAF Key Centre Address value (Tag '80') 

Contents: 

Fully qualified Domain Name (FQDN) of the NAF Key Centre used in the Local Key Establishment 
procedures (see TS 33.110 [28]). 

Coding: 

Encoded to an octet string according to UTF-8 encoding rules as described in IETF RFC 3629 [27]. 

4.2.12 EFsms (Short messages) 

This file shall be present if and only if service n°6 and n°8 are "available". 

This EF contains information in accordance with TS 23.040 [29] comprising short messages (and associated 
parameters) which have either been received by the UE from the network, or are to be used as an UE originated 

message. 



Identifier: '6F3C Structure: 


linear fixed Optional 


Record length: 176 bytes | 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Status 


M 


1 byte 


2 to 176 


Remainder 


M 


175 bytes 
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- Status. 
Contents: 

Status byte of the record which can be used as a pattern in the SEARCH RECORD command. For UE originating 
messages sent to the network, the status shall be updated when the UE receives a status report, or sends a successful 
SMS Command relating to the status report. 

Coding: 



b8 b7 b6 b5 b4 b3 b2 bl 



X X free space 

XXI used space 

1 message received by UE from network; message read 

11 message received by UE from network; message to be 

read 
111 UE originating message; message to be sent 

RFU (see TS 31.101 [3] ) 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














I 

X 


1 

X 


1 

1 


I 




1 

1 




















1 





1 

















1 


1 





1 














1 





1 





1 














1 


1 


1 





1 



UE originating message; message sent to the network: 
Status report not requested 

Status report requested but not (yet) received; 
Status report requested, received but not stored 

in EF-SMSR; 
Status report requested, received and stored 

in EF-SMSR; 

RFU (see TS 31.101 [3] ) 



Remainder. 
Contents: 

This data item commences with the TS-Service-Centre-Address as specified in TS 24.011 [30]. The bytes 
immediately following the TS-Service-Centre-Address contain an appropriate short message TPDU as specified in 
TS 23.040 [29], with identical coding and ordering of parameters. 

Coding: 

according to TS 23.040 [29] and TS 24.011 [30]. Any TP-message reference contained in an UE originated message 
stored in the USIM, shall have a value as follows: 



message to be sent: 
message sent to the network: 



Value of the TP-message-reference: 

'FF'. 

the value of TP -Message-Reference used in the 
message sent to the network. 



Any bytes in the record following the TPDU shall be filled with 'FF'. 

It is possible for a TS-Service-Centre-Address of maximum permitted length, e.g. containing more than 18 address 
digits, to be associated with a maximum length TPDU such that their combined length is 176 bytes. In this case the ME 
shall store in the USIM the TS-Service-Centre-Address and the TPDU in bytes 2 to 176 without modification, except 
for the last byte of the TPDU, which shall not be stored. 

4.2.13 EFsmss (SMS status) 

This file shall be present if and only if service n°6 and n°8 are "available". 
This EF contains status information relating to the short message service. 
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Identifier: '6F43' | 


Structure: transparent | 


Optional 


File size: 2+X bytes 


I Update activity 


low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 

ADM 
ADM 




Bytes 


Description 


M/O 


Length 


1 


Last Used TP-MR 


M 


1 byte 


2 


SMS "Memory Cap 


. Exceeded" Not. Flag 


M 


1 byte 


3 to 2+X 


RFU 


O 


X bytes 



- Last Used TP-MR. 
Contents: 

the value of the TP -Message-Reference parameter in the last mobile originated short message, as defined in 
TS 23.040 [29]. 

Coding: 

- as defined in TS 23 .040 [29] . 

SMS "Memory Capacity Exceeded" Notification Flag. 
Contents: 

this flag is required to allow a process of flow control, so that as memory capacity in the UE becomes available, the 
Network can be informed. The process for this is described in TS 23.040 [29]. 



Coding: 



bl=l means flag unset; memory capacity available; 

bl=0 means flag set; 

b2 to b8 are reserved and set to 1 . 



4.2.14 EFsmsr (Short message status reports) 

This file shall be present if and only if service n°7 and n°8 are "available". 

This EF contains information in accordance with TS 23.040 [29] comprising short message status reports which have 
been received by the UE from the network. 

Each record is used to store the status report of a short message in a record of EF SMS . The first byte of each record is the 
link between the status report and the corresponding short message in EF SMS . 



Identifier: '6F47' 


[ 


Structure: 


linear fixed I 


Optional 


Record length: 


30 bytes 


| 


Update activity 


low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 

ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 


SMS record identifier 


M 


1 


2 to 30 


SMS status report 


M 


29 bytes 



SMS record identifier. 
Contents: 

this data item identifies the corresponding SMS record in EF S ms, e-g- if this byte is coded '05' then this status report 
corresponds to the short message in record #5 of EF S ms- 



Coding: 
- '00' 



empty record; 
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'01' to 'FF' - record number of the corresponding SMS in EF SMS . 

- SMS status report: 
Contents: 

- this data item contains the SMS-STATUS-REPORT TPDU as specified in TS 23.040 [29], with identical coding and 
ordering of parameters. 

Coding: 

according to TS 23.040 [29]. Any bytes in the record following the TPDU shall be filled with FF'. 

4.2.15 EFsmsp (Short message service parameters) 

If service n°8 is "available", this file shall be present. 

This EF contains values for Short Message Service header Parameters (SMSP), which can be used by the ME for user 
assistance in preparation of mobile originated short messages. For example, a service centre address will often be 
common to many short messages sent by the subscriber. 

The EF consists of one or more records, with each record able to hold a set of SMS parameters. The first (or only) 
record in the EF shall be used as a default set of parameters, if no other record is selected. 

To distinguish between records, an alpha-identifier may be included within each record, coded on Y bytes. 

The SMS parameters stored within a record may be present or absent independently. When a short message is to be sent 
from the UE, the parameter in the USIM record, if present, shall be used when a value is not supplied by the user. 



Identifier: '6F42' | Structure: linear fixed 


[ 


Optional 


Record length: 28+Y bytes | Update activity: 


low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 toY 


Alpha-Identifier 


O 


Y bytes 


Y+1 


Parameter Indicators 


M 


1 byte 


Y+2toY+13 


TP-Destination Address 


M 


1 2 bytes 


Y+14toY+25 


TS-Service Centre Address 


M 


1 2 bytes 


Y+26 


TP-Protocol Identifier 


M 


1 byte 


Y+27 


TP-Data Coding Scheme 


M 


1 byte 


Y+28 


TP-Validity Period 


M 


1 byte 



Storage is allocated for all of the possible SMS parameters, regardless of whether they are present or absent. Any bytes 
unused, due to parameters not requiring all of the bytes, or due to absent parameters, shall be set to FF'. 

Alpha-Identifier. 
Contents: 

Alpha Tag of the associated SMS-parameter. 

Coding: 

see TS 31.102 [2] (EF ADN ). 

NOTE: The value of Y may be zero, i.e. the alpha-identifier facility is not used. By using the command GET 
RESPONSE the ME can determine the value of Y. 

Parameter Indicators. 
Contents: 

each of the default SMS parameters which can be stored in the remainder of the record are marked absent or present 
by individual bits within this byte. 

Coding: 
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allocation of bits: 

bit number Parameter indicated. 

1 TP-Destination Address. 

2 TS-Service Centre Address. 

3 TP-Protocol Identifier. 

4 TP-Data Coding Scheme. 

5 TP-Validity Period. 

6 reserved, set to 1 . 

7 reserved, set to 1 . 

8 reserved, set to 1 . 

Bit value Meaning. 

Parameter present. 

1 Parameter absent. 

TP-Destination Address. 
Contents and Coding: 
as defined for SM-TL address fields in TS 23.040 [29]. 

TP-Service Centre Address. 
Contents and Coding: 
as defined for RP -Destination address Centre Address in TS 24.01 1 [30]. 

TP-Protocol Identifier. 
Contents and Coding: 
as defined in TS 23.040 [29]. 

TP-Data Coding Scheme. 
Contents and Coding: 
as defined in TS 23.038 [17]. 

- TP-Validity Period. 
Contents and Coding: 
as defined in TS 23.040 [29] for the relative time format. 



4.3 



ISIM file structure 



This subclause contains a figure depicting the file structure of the ADF ISIM . ADF ISIM shall be selected using the AID and 
information in EF DIR . 



ADF,. 



EF IS t 
'6F07' 



EFad 
'6FAD' 



EF IMPI 
'6F02' 



EF ARR 
'6F06' 



EF 



DOMAIN 

6F03' 



EF p _cscf 
'6F09' 



EF IMPU 
'6F04' 



EFgbap 
'6FD5' 



EFgbanl 
'6FD7' 



EFnafkca 
'6FDD' 



EFsms 
'6F3C 



EF SMSS 
'6F43' 



EF SMSR 
'6F47' 



EF SMSP 
'6F42' 



Figure 1 : File identifiers and directory structures of ISIM 
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4.4 Contents of EFs at the TELECOM level 

The EFs in the Dedicated File DF TELEC om contain service related information as defined in TS 31.102 [2]. 
The structure of DF TELECOM is defined in TS 31.102 [2]. 

4.4.1 EFrsismsc (Public Service Identity of the SM-SC) 

If service n°8 is "available", this file shall be present. 

Coding and usage of this EF is defined in TS 31.102 [2]. 

This EF can be found in DF TELECOM with an identifier equal to '6FE5' as defined in TS 31.102 [2]. 

5 Application protocol 

The requirements stated in the corresponding section of TS 31.101 [3] apply to the ISIM application. 

The procedures listed in subclause "ISIM management procedures" are required for execution of the procedures in the 
subsequent subclause "ISIM security related procedures". The procedures authentication procedure, IMPI request, 
IMPU request and SIPdomain request, which are listed in subclause "ISIM security related procedures" are mandatory. 
If an ISIM Service table is available, the additional procedures are only executable if these services are indicated as 
"service available" in the ISIM Service table. However, if the procedures are implemented, it shall be in accordance 
with subclause " ISIM security related procedures". 

5.1 ISIM management procedures 
5.1.1 Initialisation 

5.1 .1 .1 ISIM application selection 

If the Terminal wants to engage in IMS operation, then after UICC activation (see TS 31.101 [3]), the Terminal shall 
select an ISIM application, if an ISIM application is listed in the EF DIR file, using the SELECT by DF name as defined 
in TS 31.101 [3]. 

After a successful ISIM application selection, the selected ISIM (AID) is stored on the UICC. This application is 
referred to as the last selected ISIM application. The last selected ISIM application shall be available on the UICC after 
a deactivation followed by an activation of the UICC. 

If a ISIM application is selected using partial DF name, the partial DF name supplied in the command shall uniquely 

identify a ISIM application. Furthermore if a ISIM application is selected using a partial DF name as specified in 

TS 31.101 [3] indicating in the SELECT command the last occurrence the UICC shall select the ISIM application stored 

as the last ISIM application. If, in the SELECT command, the options first, next/previous are indicated, they have no 

meaning if an application has not been previously selected in the same session and shall return an appropriate error 

code. 

5.1.1.2 ISIM initialisation 

The ISIM shall not indicate any language preference. It shall use the language indicated by any other application 
currently active on the UICC or by default, choose a language from EF PL at the MF level according the procedure 
defined in TS 31.101 [3]. 

If the terminal does not support the languages of EF PL , then the terminal shall use its own internal default selection. 

The Terminal then runs the user verification procedure. If the procedure is not performed successfully, the ISIM 
initialisation stops. 

Then the Terminal performs the administrative information request. 
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If all these procedures have been performed successfully then the ISIM session shall start. In all other cases the ISIM 
session shall not start. 

After the previous procedures have been completed successfully, the Terminal runs the following procedures: 

IMPI request. 

- IMPU request. 

- SIP Domain request. 

ISIM Service Table request. If the ISIM Service Table is not present, the terminal shall assume that no optional 
services are available. 

P-CSCF address request 

After the ISIM initialisation has been completed successfully, the Terminal is ready for an ISIM session and shall 
indicate this to the ISIM by sending a particular STATUS command. 

5.1 .2 ISIM Session termination 

NOTE 1: This procedure is not to be confused with the deactivation procedure in TS 31.101 [3]. 

The ISIM session is terminated by the Terminal as follows. 

The Terminal shall indicate to the ISIM by sending a particular STATUS command that the termination procedure is 
starting. 

Finally, the ME deletes all these subscriber related information elements from its memory. 

NOTE 2: If the Terminal has already updated any of the subscriber related information during the ISIM session, 
and the value has not changed until ISIM session termination, the Terminal may omit the respective 
update procedure. 

To actually terminate the session, the Terminal shall then use one of the mechanisms described in TS 31.101 [3]. 



5.1 .3 ISIM application closure 

After termination of the ISIM session as defined in subclause 5.1.2, the ISIM application may be closed by closing the 
logical channels that are used to communicate with this particular ISIM application. 

5.1 .4 UICC presence detection 

The Terminal checks for the presence of the UICC according to TS 31.101 [3] within all 30 s periods of inactivity on 
the UICC-Terminal interface during a IMS session. If the presence detection according to TS 31.101 [3] fails the 
session shall be terminated as soon as possible but at least within 5s after the presence detection has failed. 

5.1 .5 Administrative information request 

The Terminal performs the reading procedure with EF AD . 

5.2 ISIM security related procedures 
5.2.1 Authentication procedure 

The Terminal selects an ISIM application and uses the AUTHENTICATE command (see subclause 7.1). The response 
is sent to the Terminal(in case of the T=0 protocol when requested by a subsequent GET RESPONSE command). 



ETSI 



3GPP TS 31.103 version 8.3.0 Release 8 24 ETSI TS 131 103 V8.3.0 (2010-10) 

5.2.2 IMPI request 

The Terminal performs the reading procedure with EF IMPI 

5.2.3 IMPU request 

The Terminal performs the reading procedure with EF IMPU 

5.2.4 SIP Domain request 

The Terminal performs the reading procedure with EF DO main- 

5.2.5 Void 

5.2.6 ISIM Service Table request 

Requirement: ISIM Service Table available in the ISIM 
Request: The ME performs the reading procedure with EF IS t. 

5.2.7 P-CSCF address request 

Requirement: ISIM Service n°l and/or ISIM Service n°5 "available". 
Request: The ME performs the reading procedure with EF P . CSCF . 

5.2.8 Generic Bootstrapping architecture (Bootstrap) 

Requirement: ISIM Service n°2 "available". 

The Terminal uses the AUTHENTICATE command in GBA security context (Bootstrapping Mode) (see 7.1.1). The 
response is sent to the Terminal. 

After a successful GBA_U Procedure, the Terminal shall update the B-TID field and the Key Life Time field in 
EF GBABP 

5.2.9 Generic Bootstrapping architecture (NAF Derivation) 

Requirement: ISIM Service n°2 "available". 

The Terminal shall first read EF GBABP . The Terminal then uses the AUTHENTICATE command in GBA security 
context (NAF Derviation Mode) (see 7.1.1). The response is sent to the Terminal. 

5.2.10 HTTP-Digest security request 

Requirement: ISIM Service n°3 "available". 

This HTTP-Digest security request does not apply for 3GPP and shall not be used by a terminal using a 3GPP access 
network or a 3GPP Interworking WLAN. 

5.2.1 1 NAF Key Centre Address request 

Requirement: Service n°2 and service n°4 "available". 

Request: The ME performs the reading procedure with EF NAFKCA . 
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5.3 Subscription related procedures 
5.3.1 SM-over-IP 

Requirement: Service n°8 "available". 

Request: the ME performs the reading procedure with EF PS ismsc- 

Update: The ME performs the updating procedure with EF PSISMSC . 



Security features 



The security aspects of IMS are specified in TS 33.203 [14]. This clause gives information related to security features 
supported by the ISIM with respect to user verification and file access conditions. 

6.1 User verification and file access conditions 

The security architecture as defined in TS 31.101 [3] applies to the ISIM and UICC with the following definitions and 
additions: 

The ISIM application shall use a global key referenceas PIN1 as specified in TS 31.101 [3], 

For access to DF TE lecom the PIN shall be verified. 

The only valid usage qualifier is '08' which means user authentication knowledge based (PIN) as defined in 
ISO/IEC 7816-4 [6]. 



7 ISIM Commands 

The commands specified in TS 31.101 [3] are supported by ISIM, with the restrictions identified in this clause. 

7.1 AUTHENTICATE 

7.1.1 Command description 

The function can be used in several different contexts: 

an IMS AKA security context during the procedure for authenticating the ISIM to its HN and vice versa when 
IMS AKA authentication data are available. The function shall be used whenever an IMS context shall be 
established, i.e. when the terminal receives a challenge from the IMS. A cipher key and an integrity key are 
calculated. For the execution of the command the ISIM uses the subscriber authentication key K, which is stored 
in the ISIM. 

a HTTP Digest security context, when HTTP Digest authentication data are available. Digest authentication 
operations are described in IETF RFC 2617 [26]. 

a GBA_U security context, when a GBA bootstrapping procedure is requested. In this context the function is 
used in two different modes: 

a) Bootstrapping Mode: during the procedure for mutual authenticating of the ISIM and the Bootstrapping 
Server Function (BSF) and for deriving Bootstrapped key material from the AKA run. 

b) NAF Derivation Mode: during the procedure for deriving Network Application Function (NAF) specific keys 
from previous bootstrapped key material. 

a Local Key Establishment security context, when a Local Key Establishment procedure is requested. 
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The function is related to a particular ISIM and shall not be executable unless the ISIM application has been selected 
and activated, and the current directory is the ISIM ADF or any subdirectory under this ADF and a successful PIN 
verification procedure has been performed (see clause 5). 

7.1.1.1 IMS AKA security context 

The ISIM first computes the anonymity key AK = f5x (RAND) and retrieves the sequence number 
SQN = (SQN © AK) © AK. 

Then the ISIM computes XMAC = fl K (SQN II RAND II AMF) and compares this with the MAC which is included in 
AUTN. If they are different, the ISIM abandons the function. 

Next the ISIM verifies that the received sequence number SQN is previously unused. If it is unused and its value is 
lower than SQN MS , it shall still be accepted if it is among the last 32 sequence numbers generated. A possible 
verification method is described in TS 33.102 [4]. 

NOTE: This implies that the ISIM has to keep a list of the last used sequence numbers and the length of the list is 
at least 32 entries. 

If the ISIM detects the sequence numbers to be invalid, this is considered as a synchronisation failure and the ISIM 
abandons the function. In this case the command response is AUTS, where: 

- AUTS = Conc(SQN MS ) 1 1 MACS; 

- Conc(SQN MS ) = SQN MS ®f5* K (RAND) is the concealed value of the counter SQN MS in the ISIM; and 

- MACS= fl *k(SQN ms 1 1 RAND 1 1 AMF) where: 

RAND is the random value received in the current user authentication request; 

the AMF assumes a dummy value of all zeroes so that it does not need to be transmitted in clear in the 
resynchronisation message. 

If the sequence number is considered in the correct range, the ISIM computes RES = f2 K (RAND), the cipher key 
CK = f3 K (RAND) and the integrity key IK = f4 K (RAND) and includes these in the command response. Note that if 
this is more efficient, RES, CK and IK could also be computed earlier at any time after receiving RAND. 

The use of AMF is HN specific and while processing the command, the content of the AMF has to be interpreted in the 
appropriate manner. The AMF may e.g. be used for support of multiple algorithms or keys or for changing the size of 
lists, see TS 33.102 [4]. 

7.1 .1 .2 GBA security context (Bootstrapping Mode) 

ISIM operations in GBA security context are supported if service n°2 is "available". 

The ISIM receives the RAND and AUTN*. The ISIM first computes the anonymity key AK = f5 K (RAND) and 
retrieves the sequence number SQN = (SQN © AK) © AK. 

The ISIM calculates IK = f4 K (RAND) and MAC (by performing the MAC modification function described in 
TS 33.220 [25]). Then the ISIM computes XMAC = fl K (SQN II RAND II AMF) and compares this with the MAC 
previously produced. If they are different, the ISIM abandons the function. 

Then the ISIM performs the remaining checking of AUTN* as in IMS security context. If the ISIM detects the sequence 
numbers to be invalid, this is considered as a synchronisation failure and the ISIM abandons the function. In this case 
the command response is AUTS, which is computed as in ISIM security context. 

If the sequence number is considered in the correct range, the ISIM computes RES = f2 K (RAND) and the cipher key 
CK = f3 K (RAND). 

The ISIM then derives and stores GBA_U bootstrapped key material from CK, IK values. The ISIM also stores RAND 
in the RAND field of EF GBA bp 

The ISIM stores GBA_U bootstrapped key material from only one bootstrapping procedure. The previous bootstrapped 
key material, if present, shall be replaced by the new one. This key material is linked with the data contained in EF GB abp 
: RAND, which is updated by the ISIM and B-TID, which shall be further updated by the ME. 
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NOTE: According to TS 33.220 [25], NAF-specific keys that may be stored on the ISIM are not affected by this 
bootstrapping operation. 

RES is included in the command response after flipping the least significant bit. 

Input: 

- RAND, AUTN* 
Output: 

- RES 
or 

- AUTS 

7.1 .1 .3 GBA security context (NAF Derivation Mode) 

ISIM operations in GBA security context are supported if service n°2 is "available". 

The ISIM receives the NAF_ID. 

The ISIM performs Ks_ext_NAF and Ks_int_NAF derivation as defined in TS 33.220 [25] using the key material from 
the previous GBA_U bootstrapping procedure and the IMPI value from EF IMPI 

If no key material is available this is considered as a GBA Bootstrapping failure and the ISIM abandons the function. 
The status word "6985" (Conditions of use not satisfied) is returned. 

Otherwise, the ISIM stores Ks_int_NAF and associated B-TID together with NAF_ID in its memory. The Ks_int_NAF 
keys related to other NAF_IDs, which are already stored in the ISIM, shall not be affected. The ISIM updates EF GBANL 
as follows: 

If a record with the given NAF_ID already exists, the ISIM updates the B-TID field of this record with the B- 
TID value associated to the GBA_U bootstrapped key involved in this GBA_U NAF derivation procedure. 

If a record with the given NAF_ID does not exist, the ISIM uses an empty record to store the NAF_ID and the 
B-TID value associated to the GBA_U bootstrapped key involved in this GBA_U NAF Derivation procedure. 

NOTE: According to TS 33.220 [25], the ISIM can contain several Ks_int_NAF together with the associated B- 
TID and NAF_ID, but there is at most one pair of Ks_int_NAF and associated B-TID stored per 
NAF_ID. 

In case no empty record is available the ISIM shall overwrite an existing record to store the NAF_ID and the B- 
TID value associated to the GBA_U bootstrapped key involved in this GBA_U NAF Derivation procedure. To 
determine the record to overwrite, the ISIM shall construct a list of record numbers by storing in the list first 
position the record number of the last used (i.e. involved in an Authentication command) or derived Ks_int_NAF 
and by shifting down the remaining list elements. The last record number in this list corresponds to the record to 
overwrite when the ISIM runs out of free records. If an existing record corresponding to a Ks_int_NAF key in 
use is overwritten, the application Ks_int_NAF shall not be affected. 

Then, the ISIM returns Ks_ext_NAF. 

Input: 

- NAF_ID 
Output: 

- Ks_ext_NAF 

7.1 .1 .4 HTTP-Digest security context 

ISIM operations in HTTP-Digest security context are supported if service n°3 is "available". 
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7.1 .1 .5 Local Key Establishment security context (Key Derivation mode) 

ISIM operations in this security context are supported if service n°2 and service n°4 are "available". 

The ISIM receives the NAF_ID corresponding to the NAF Key Centre, the Terminal_ID, the Terminal_appli_ID, the 
UICC_appli_ID, RANDx, the Counter Limit value and the MAC as described in TS 33.110 [28]. 

The ISIM uses the NAF_ID to identify the Ks_int_NAF associated to the NAF Key Centre. If no valid Ks_int_NAF is 
available, this is considered as a Key Establishment failure and the ISIM abandons the function. The status word '6A88' 
(Referenced data not found) is returned. 

If the Ks_local key derivation is not authorized by the local UICC policy (e.g. Terminal_appli_ID/UICC_appli_ID 
association not authorized or Terminal_ID value not authorized), the ISIM abandons the function. The status word 
'6985' (Conditions of use not satisfied) is returned. 

Otherwise, the ISIM retrieves the appropriate Ks_int_NAF, derives Ks_local as described in TS 33.1 10 [28]. The ISIM 
verifies the MAC value received from the Terminal as described in TS 33.110 [28]: 

If the verification is unsuccessful, the ISIM abandons the function and returns the status word '9862' 
(Authentication error, incorrect MAC). 

If the verification is successful, the ISIM stores Ks_local and associated parameters TerminalJD, 
Terminal_appli_ID, UICC_appli_ID, RANDx and the Ks_local Counter Limit. The ISIM returns the Local Key 
Establishment Operation Response TLV (indicating a successful Key Derivation operation) and a response 
MAC, which is derived as described in TS 33.1 10 [28]. 

The minimum number of Local keys that can be stored by the ISIM shall be defined by the service provider at the pre- 
issuance of the card. 

In case the maximum number of Local Key was already reached or there is not enough available memory in the ISIM, 
the ISIM shall overwrite a Local Key and its associated data in order to store the new one. To determine the Ks_local to 
overwrite, the ISIM shall construct a list of Ks_local identifiers by storing in the list first position the Ks_local identifier 
of the last used or derived Ks_local and by shifting down the remaining list elements. The last Ks_local identifier in this 
list corresponds to the Ks_local to overwrite when the ISIM runs out of free memory or when the maximum number of 
Ks_local keys is reached. If an existing Ks_local in use is overwritten, the application using Ks_local shall not be 
affected. 

Input: 

Local Key Establishment Mode (Key Derivation mode), Counter Limit, request MAC, Key Identifier (i.e. 
NAF_ID, Terminal_ID, Terminal_appli_ID, UICC_appli_ID, RANDx) 

Output: 

Key Derivation operation status, response MAC. 

7.1 .1 .6 Local Key Establishment security context (Key Availability Check mode) 

ISIM operations in this security context are supported if service n°2 and service n°4 are "available". 

The ISIM receives a Ks_local identifier. The ISIM checks if a corresponding valid Ks_local is available. If a valid 
Ks_local key is available the Local Key Establishment Operation Response TLV (indicating a successful Key 
Availability Check operation) is returned. In case no valid Ks_local key is available the command fails and the status 
word '6A88' (Referenced data not found) is returned. 



Input: 

Local Key Establishment Mode (Key Availability Check mode), Key identifier (i.e. NAF_ID, TerminalJD, 
Terminal_appli_ID, UICC_appli_ID, RANDx). 

Output: 

Key Availability Check Operation Status. 
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7.1 .2 Command parameters and data 



This command can be used with an EVEN or an ODD instruction (INS) code. The EVEN instruction code can be used 
when the challenge data provided by the terminal is not TLV encapsulated data and the length of the challenge data 
provided by the terminal is less than 256 bytes. 

The ODD instruction code shall be used with the security context specified in table 1, when challenge and response data 
is TLV encapsulated regardless of their length. Terminals and UICCs that do not support security context requiring 
TLV format (e.g. for Local Key Establishment), do not have to support AUTHENTICATE command with ODD 
instruction code. 

EVEN INS code 



Code 


Value 


CLA 


As specified in TS 31.101 


INS 


'88' 


P1 


'00' 


P2 


See table below 


Lc 


See below 


Data 


See below 


Le 


'00', or maximum length of data expected in response 



Parameter P2 specifies the authentication context as follows: 
Coding of the reference control P2: 



Coding 
b8-b1 


Meaning 


'1 ' 


Specific reference data (e.g. DF 
specific/application dependant key) 


'-XXXX— ' 


'0000' 


'- — XXX' 


Authentication context: 

000 Reserved 

001 IMS AKA 
010 HTTP Digest 
1 00 GBA context 



All other codings are RFU. 

ODD INS code 

The authentication data and the authentication response data are encapsulated in BER-TLV objects structured using tag 
73' for BER-TLV structured data and tag '53' otherwise. 

How this command can chain successive blocks of authentication data, or authentication response data is described in 
TS 31 101 [3]. 

If PI indicates "First block of authentication data" or "Next block of authentication data": 

Input: 

Authentication data encapsulated in a BER-TLV data object. 
Output: 

None. 
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Code 


Value 


CLA 


As specified in TS 31.101 [3] 


INS 


'89' 


P1 


As specified in TS 31.101 [3] 


P2 


See table 1 below 


Lc 


Length of the subsequent data field 


Data 


Authentication related data 


Le 


Not present 



If PI indicates "First block of authentication response data" or "Next block of authentication response data": 
Input: 

None. 
Output: 

Authentication response data encapsulated in a BER-TLV data object. 



Code 


Value 


CLA 


As specified in TS 31.101 [3] 


INS 


'89' 


P1 


As specified in TS 31.101 [3] 


P2 


See table 1 below 


Lc 


Not present 


Data 


Not present 


Le 


Length of the response data 



Parameter PI is used to control the data exchange between the terminal and the UICC as defined in TS 31 101 [3]. 
Parameter P2 specifies the authentication context as follows: 

Table 1 : Coding of the reference control P2 



Coding 
b8-b1 


Meaning 


•1 ■ 


Specific reference data (e.g. DF specific/application dependant key) 


' XXX' 


Authentication context: 

110 Local Key Establishment mode 



All other codings are RFU. 
Command parameters/data: 



7.1.2.1 



IMS AKA security context 



Byte(s) 


Description 


Length 


1 


Length of RAND (L1) 


1 


2 to (L1+1) 


RAND 


L1 


(L1+2) 


Length of AUTN (L2) 


1 


(L1+3)to 
(L1+L2+2) 


AUTN 


L2 



The coding of AUTN is described in TS 33.102 [4]. The most significant bit of RAND is coded on bit 8 of byte 2. The 
most significant bit of AUTN is coded on bit 8 of byte (Ll+3). 

Response parameters/data, case 1, command successful: 
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Byte(s) 


Description 


Length 


1 


"Successful 3G authentication" tag = 'DB' 


1 


2 


Length of RES (L3) 


1 


3 to (L3+2) 


RES 


L3 


(L3+3) 


Length of CK (L4) 


1 


(L3+4) to 
(L3+L4+3) 


CK 


L4 


(L3+L4+4) 


Length of IK (L5) 


1 


(L3+L4+5) to 
(L3+L4+L5+4) 


IK 


L5 



The most significant bit of RES is coded on bit 8 of byte 3. The most significant bit of CK is coded on bit 8 of byte 
(L3+4). The most significant bit of IK is coded on bit 8 of byte (L3+L4+5). 

Response parameters/data, case 2, synchronization failure: 



Byte(s) 


Description 


Length 


1 


"Synchronisation failure" tag = 'DC 


1 


2 


Length of AUTS(L1) 


1 


3to(L1+2) 


AUTS 


L1 



The coding of AUTS is described in TS 33.102 [4]. The most significant bit of AUTS is coded on bit 8 of byte 3. 



7.1.2.2 



HTTP Digest security context 



Byte(s) 


Description 


Length 


1 


Length of realm (L1) 


1 


2 to (L1+1) 


Realm 


L1 


(LU2) 


Length of nonce (L2) 


1 


(L1+3)to 
(L1+L2+2) 


Nonce 


L2 


(L1+L2+3) 


Length of cnonce (L3) 


1 


(L1+L2+4)to 
(L1+L2+L3+3) 


Cnonce 


L3 



The codings of realm, nonce and cnonce are described in IETF RFC 2617 [26]. 
Response parameters/data command successful: 



Byte(s) 


Description 


Length 


1 


"HTTP Digest context reponse" tag = 'DB' 


1 


2 


Length of Response(L4) 


1 


3 to (L4+2) 


Response 


L4 


(L4+3) 


Length of Session Key (L5) 


1 


(L4+4) to 
(L4+L5+3) 


Session Key 


L5 



7.1.2.3 



GBA security context (Bootstrapping Mode) 



Byte(s) 


Description 


Length 


1 


'GBA Security Context Bootstrapping Mode' tag = "DD" 


1 


2 


Length of RAND (L1) 


1 


3to(L1+2) 


RAND 


L1 


(L1+3) 


Length of AUTN (L2) 


1 


(L1+4)to 
(L1+L2+3) 


AUTN 


L2 



Response parameters/data, GBA security context (Bootstrapping Mode), synchronisation failure: 
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Byte(s) 


Description 


Length 


1 


"Synchronisation failure" tag = 'DC 


1 


2 


Length of AUTS (L1 ) 


1 


3to(L1+2) 


AUTS 


L1 



AUTS coded as for IMS Security context. 

Response parameters/data, GBA security context (Bootstrapping Mode), command successful: 



Byte(s) 


Description 


Length 


1 


"Successful GBA operation" tag = 'DB' 


1 


2 


Length of RES (L) 


1 


3 to (L+2) 


RES 


L 



RES coded as for IMS Security context. 

7.1 .2.4 GBA security context (NAF Derivation Mode) 



Byte(s) 


Description 


Length 


1 


'GBA Security Context NAF Derivation Mode' tag = "DE" 


1 


2 


Length of NAF ID (L1) 


1 


3to(L1+2) 


NAF ID 


L1 



Response parameters/data, GBA security context (NAF Derivation Mode), command successful: 



Byte(s) 


Description 


Length 


1 


"Successful GBA operation" tag = 'DB' 


1 


2 


Length of Ks ext NAF (L) 


1 


3 to (L+2) 


Ks ext NAF 


L 



Coding of Ks_ext_NAF as described in TS 33.220 [25]. 



7.1.2.5 



Local Key Establishment security context (All Modes) 



The Local Key Establishment Control TLV is included in the command data to indicate the security context mode. The 
Local Key Establishment Control TLV is also included in the response data to indicate the operation status. 

Table 2: Coding of the Local Key Establishment Control TLV 



Tag Value 


Length 


Value / Meaning 


'80' 


Coded according to 
ISO/IEC 8825 [20] 


Local Key Establishment context: 
'01': Key Derivation mode 
'02': Key Availability Check mode 

Operation Status: 

'DB': Successful Operation 



7.1 .2.5.1 Local Key Establishment security context (Key Derivation mode) 

Command parameters/data: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Derivation Data Object tag ("73") 


As defined in TS 31.101 [3] for BER- 
TLV data object 


1 


2 to A+1 bytes (A < 4) 


Key Derivation Data Object length (L) 


As defined in TS 31.101 [3] for BER- 
TLV data object 


A 


A+2to(A+L+1) 


Key Derivation Data Object 




L 



Key Derivation Data Object content: The TLVs defined in table 3 are included in the Key Derivation Data 
Object. 
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Table 3: Coding of the Key Derivation Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment Control 
TLV 


Coded as defined in 

section 7.1.2.5. The 

value field shall be set 

to '01' 


M 


B 


Counter Limit tag 


'81' 


M 


1 


Length 


C 


M 


Note 1 


Counter Limit 


Coded as defined in 
TS 33.1 10 [28] 


M 


C 


Request MAC tag 


'82' 


M 


1 


Length 


D 


M 


Note 1 


Request MAC 


Coded as defined in 
TS 33.1 10 [28] 


M 


D (see Note 3) 


Key Identifier tag 


'A0' 


M 


1 


Length 


E (see Note 2) 


M 


Note 1 


NAF ID tag 


'83' 


M 


1 


Length 


F 


M 


Note 1 


NAFJD 


Coded as defined in 
TS 33.220 [25] 


M 


F 


Terminal ID tag 


'84' 


M 


1 


Length 


G 


M 


Note 1 


TerminalJD 


Coded as defined in 
TS 33.1 10 [28] 


M 


G 


Terminal appli ID tag 


'85' 


M 


1 


Length 


H 


M 


Note 1 


Terminal_appli_ID 


Coded as defined in 
TS 33.1 10 [28] 


M 


H 


UICC appli ID tag 


'86' 


M 


1 


Length 


I 


M 


Note 1 


UICC_appli_ID 


Coded as defined in 
TS 33.1 10 [28] 


M 


I 


RAN Dx tag 


'87' 


M 


1 


Length 


J 


M 


Note 1 


RANDx 


Coded as defined in 
TS 33.1 10 [28] 


M 


J (see Note 4) 


Note 1 : The length is coded according to ISO/I EC 8825 [20] 

Note 2: The Key Identifier TLV is a constructed TLV containing the following primitive 

TLVs: NAFJD, TerminalJD, Terminal_appliJD, UICC_appliJD and RANDx. E 

is the length of the constructed Key Identifier value. 
Note 3: The most significant bit of the request MAC is coded on bit 8 of the first byte 

following the MAC Length. 
Note 4: The most significant bit of the RANDx is coded on bit 8 of the first byte following 

the RANDx Length. 



Response parameters/data, Local Key Establishment security context (Key Derivation mode), command successful: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Derivation Operation Response Data 
Object tag ("73") 


As defined in TS 31.101 [3] for 
BER-TLV data object 


1 


2toA1+1 bytes (A1 < 4) 


Key Derivation Operation Response Data 
Object length (L1 ) 


As defined in TS 31.101 [3] for 
BER-TLV data object 


A1 


A1+2to(A1+L1+1) 


Key Derivation Operation Response Data 
Object 




L1 



Key Derivation Operation Response Data Object content: The TLVs defined in table 4 are included in the Key 
Derivation Operation Response Data Object. 



ETSI 



3GPP TS 31.103 version 8.3.0 Release 8 



34 



ETSI TS 131 103 V8.3.0 (2010-10) 



Table 4: Coding of the Key Derivation Operation Response Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment Control 
TLV 


Coded as defined in 

section 7.1.2.5. The 

value field shall be 

set to 'DB' 


M 


B 


Response MAC tag 


'82' 


M 


1 


Length 


C 


M 


Note 1 


Response MAC 


Coded as defined in 
TS 33.1 10 [28] 


M 


C (see Note 2) 


Note 1 : The length is coded according to ISO/I EC 8825 [20] 

Note 2: The most significant bit of the response MAC is coded on bit 8 of the first byte 
following the MAC length. 



7.1 .2.5.2 Local Key Establishment security context (Key Availability Check mode) 

Command parameters/data: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Availability Check Data Object tag 
("73") 


As defined in TS 31.101 [3] for BER- 
TLV data object 


1 


2 to 1+Abytes(A<4) 


Key Availability Check Data Object 
length (L) 


As defined in TS 31.101 [3] for BER- 
TLV data object 


A 


A+2to(A+L+1) 


Key Availability Check Data Object 




L 



Key Availability Check Data Object content: The TLVs defined in table 5 are included in the Key Availability 
Check Data Object. 

Table 5: Coding of the Key Availability Check Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment 
Control TLV 


Coded as defined in 

section 7.1 .2.5. The value 

field shall be set to '02' 


M 


B 


Key Identifier TLV 


Coded as defined in 
section 7.1.2.5.1 


M 


C 



Response parameters/data, Local Key Establishment security context (Key Availability Check mode), command 
successful: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Availability Check Operation Response 
Data Object tag ("73") 


As defined in TS 31.101 [3] for 
BER-TLV data object 


1 


2 to 1 +A1 bytes (A1 < 4) 


Key Availability Check Operation Response 
Data Object length (L1) 


As defined in TS 31.101 [3] for 
BER-TLV data object 


A1 


A1+2to(A1+L1+1) 


Key Availability Check Operation Response 
Data Object 




L1 



Key Availability Check Operation Response Data Object content: The TLV defined in table 6 is included in the 
Key Availability Check Operation Response Data Object. 

Table 6: Coding of the Key Availability Check Operation Response Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment Control TLV 


Coded as defined in 

section 7.1.2.5. The 

value field shall be 

set to 'DB' 


M 


B 
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7.1 .3 Status Conditions Returned by the ISIM 

Status of the card after processing of the command is coded in the status bytes S Wl and SW2. This subclause specifies 
coding of the status bytes in the following tables. 



7.1.3.1 



Security management 



SW1 


SW2 


Error description 


'98' 


'62' 


- Authentication error, incorrect MAC 



7.1.3.2 



Status Words of the Commands 



The following table shows for each command the possible status conditions returned (marked by an asterisk *). 

Commands and status words 



Status Words 


AUTHENTICATE 


90 00 


* 


91 XX 


* 


93 00 




98 50 




98 62 


* 


62 00 


* 


62 81 




62 82 




62 83 




62 F1 


* 


62 F3 


* 


63 CX 




63 F1 


* 


64 00 


* 


65 00 


* 


65 81 


* 


67 00 


* 


67 XX - (see note) 


* 


68 00 


* 


68 81 


* 


68 82 


* 


69 81 




69 82 


* 


69 83 




69 84 


* 


69 85 


* 


69 86 




6A80 




6A81 


* 


6A82 




6A83 




6A86 


* 


6A87 




6A88 


* 


6B00 


* 


6E00 


* 


6F00 


* 


6F XX -(see note) 


* 


NOTE: Except SW2 = '00'. 



7.2 GET CHALLENGE 

The GET CHALLENGE command is optional for the ISIM application. 
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8 



Void 



ETSI 



3GPP TS 31.103 version 8.3.0 Release 8 



37 



ETSI TS 131 103 V8.3.0 (2010-10) 



Annex A (informative): 

EF changes via Data Download or USAT applications 

This annex defines if changing the content of an EF by the network (e.g. by sending an SMS) or by a USAT 
Application is advisable. Updating of certain EFs "over the air" could result in unpredictable behaviour of the UE; these 
are marked "Caution" in the table below. Certain EFs are marked "No"; under no circumstances should "over the air" 
changes of these EFs be considered. 



File identification 


Description 


Change advised 


'6F02' 


IMS private user identity 


Caution (note) 


'6F03' 


Home Network Domain Name 


Caution (note) 


'6F04' 


IMS public user identity 


Caution (note) 


'6FAD' 


Administrative Data 


Caution 


'6F06' 


Access Rule Reference 


Caution 


"6F07" 


ISIM Service Table 


Caution 


"6F09" 


P-CSCF address 


Caution (note) 


'6FD5" 


GBA Bootstrapping parameters 


Caution 


'6FD7" 


GBA NAF List 


Caution 


'6FDD" 


NAF Key Centre Address 


Caution 


'6F3C 


Short messages 


Yes 


'6F42' 


SMS parameters 


Yes 


'6F43' 


SMS status 


Yes 


'6F47' 


Short message status reports 


Yes 


'6FE5' 


Public Service Identity of the SM-SC 


Yes 


NOTE: If EFimpi, EF| M pu, EFdomain or P-CSCF are changed, the UICC should issue a 
REFRESH command. 
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Annex B (informative): 
Tags defined in 31.103 



Tag 


Name of Data Element 


Usage 


'80' 


NAF ID 


EFgbanl 


'80' 


NAI TLV data object 


EFimpi 


'80' 


P-CSCF TLV data object 


EFp-cscf 


'80' 


URI TLV data object 


EFimpu, EFdomain 


'81' 


B-TID 


EFgbanl 


'DB' 


Successful IMS authentication 


Response to AUTHENTICATE'IMS AKA security 
context' 


'DB' 


HTTP Digest Context response 


Response to AUTHENTICATE 'HTTP Digest 
security context' 


'DB' 


Successful GBA operation 


Response to AUTHENTICATE 'GBA security 
context' 


'DC 


Synchronisation failure 


Response to AUTHENTICATE 'IMS AKA security 
context' or 'GBA security context (Bootstrapping 
Mode)' 


'DD' 


GBA Security Context Bootstrapping Mode 


AUTHENTICATE 'GBA security context' 


'DE' 


GBA Security Context NAF Derivation Mode 


AUTHENTICATE 'GBA security context' 



NOTE: the value 'FF' is an invalid tag value. For ASN.l tag assignment rules see ISO/IEC 8825 [20] 
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Annex C (informative): 

Suggested contents of the EFs at pre-personalization 

If EFs have an unassigned value, it may not be clear from the main text what this value should be. This annex suggests 
values in these cases. 



File Identification 


Description 


Value 








'6F02' 


IMS private user identity 


"8000FF...FF" 


'6F03' 


Home Network Domain Name 


"8000FF...FF" 


'6F04' 


IMS public user identity 


"8000FF...FF" 


'6FAD' 


Administrative Data 


Operator dependant 


'6F06' 


Access Rule Reference 


Card issuer/operator dependant 


'6FD5" 


GBA Bootstrapping parameters 


"FF...FF" 


"6F07" 


ISIM Service Table 


Operator dependant 


"6F09" 


P-CSCF address 


Operator dependant 


"6FD7" 


GBA NAF List 


"FF...FF" 


"6FDD" 


NAF Key Centre Address 


'FF...FF' 
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Annex D (informative): 
List of SFI Values 

This annex lists SFI values assigned in the present document. 



D.1 List of SFI Values at the ISIM ADF Level 


File Identification 


SFI 


Description 


'6F02' 


'02' 


IMS private user identity 


'6F03' 


'05' 


Home Network Domain Name 


'6F04' 


'04' 


IMS public user identity 


'6FAD' 


'03' 


Administrative Data 


'6F06' 


'06' 


Access Rule Reference 


"6F07" 


"07" 


ISIM Service Table 



All other SFI values are reserved for future use. 
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Annex E (informative): 

ISIM Application Session Activation / Termination 

The purpose of this annex is to illustrate the different Application Session procedures. 

Terminal UICC 



Application selection 



r 



Application initialisation , 
procedure > 



Application initialisation 
procedure is terminated 



Select AID=ISIM 



Select File 



Read Binary 



Status 



(P1='0V) 



Figure E.1: ISIM Application Session Activation procedure 



Terminal 



UICC 



Application 

termination procedure 
is started 



Application termination 



r 



procedure 



< 



Status 


^ 


(P1='02') 
Select File 




Update Binary 




Select AID=ISIM 




(P2='40') 


w 



Application closure 



Figure E.2: ISIM Application Session Termination procedure 
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Annex F (informative): 
Change History 



The table below indicates all CRs that have been incorporated into the present document since it was initially approved. 



TSG# 


TSG TD# 


WGTD# 


CR 


Rev 


Cat 


Subject/Comment 


New 


TP-16 


TP-020124 










Initial version for information and approval in one step 

Comment: 

T#16 approved the specification to be part of Rel-5. The only 

changes to v1 .0.0 are in the references clause for the reference in 

[161 


1.0.0 


TP-17 


TP-020211 


- 


001 


- 


F 


Corrections 


5.1.0 


TP-18 


TP-020281 


- 


002 


- 


F 


Replace reference to TS 31.1 10 by reference to ETSI TS 101 220 


6.0.0 


TP-18 


TP-020281 


- 


003 


- 


F 


Management of last selected ISIM 




TP-18 


TP-020281 




004 




D 


Gather all 3GPP-specific card platform requirements into TS 
31.101, and remove them from TS 31.103. 
NOTE: This CR created Rel-6 of TS 31 .1 03. 




TP-19 


TP-030019 


- 


006 




F 


Alignment with the Stage 2 terminology 


6.1.0 


TP-20 


TP-030122 


- 


008 




A 


Clarification that the home operator's network domain name is a 
SIP URI. 


6.2.0 


TP-23 


TP-040025 


- 


012 






Essential corrections to remove Session Keys 


6.3.0 


TP-23 


TP-040025 


- 


014 






Creation of an ISIM Service Table 




TP-23 


TP-040067 


- 


013 






New EF for P-CSCF Addresses in ISIM 




TP-24 


TP-040102 


- 


015 




F 


Clarification that the P-CSCF address shall not be used by a 3GPP 
terminal accessing a Interworking WLAN 


6.4.0 


TP-25 


TP-040182 


- 


017 




B 


GBAU ME-ISIM interface 


6.5.0 


TP-25 


TP-040182 


- 


016 




B 


New 3GPP2 IMS authentication context in ISIM 


6.5.0 


TP-26 


TP-040257 


- 


019 




B 


Storage of the lifetime of the GBA U bootstrapped keys 


6.6.0 


TP-26 


TP-040257 


- 


021 




F 


Correction of non specific references 


6.6.0 


TP-27 


TP-050019 


T3-050126 


022 




A 


Reservation of file IDs under ADF ISIM 


6.7.0 


TP-27 


TP-050019 


T3-050182 


024 




F 


Completion of GBA U-related procedures 


6.7.0 


TP-27 


TP-050019 


T3-050185 


025 




F 


Storage of NAF-keys identifiers in GBAJJ 


6.7.0 


CT-28 


TP-050136 


C6-050416 


027 




A 


ISO/IEC 7816-series revision 


6.8.0 


CT-29 


CP-050330 


C6-050731 


029 


1 


A 


Default Record for EFIMPU 


6.9.0 


CT-29 


CP-050335 


C6-050693 


030 




F 


Corrections of EFIST Service No. referencing 


6.9.0 


CT-29 


CP-050335 


C6-050694 


031 




F 


Changes in Application Protocol due to the use of ISIM Service 
Table 


6.9.0 


CT-30 


CP-050492 


C6-050885 


035 




F 


Subscription related procedures 


6.10.0 


CT-30 


CP-050492 


C6-050904 


033 




F 


Encoding of IMPI, IMPU and Domain 


6.10.0 


CT-32 


CP-060243 


C6-060282 


0036 




F 


Add missing EF in ISIM file structure 


7.0.0 


CT-32 


CP-060243 


C6-060319 


0037 




F 


Update of the table summarizing the tags defined in 31.103 


7.0.0 


CT-33 


CP-060386 


C6-06051 1 


0040 


1 




Correction of ISIM Service Table 


7.1.0 


CT-33 


CP-060386 


C6-060514 


0043 


1 




Coding of P2 


7.1.0 


CT-36 


CP-070294 


C6-070314 


0045 


1 


A 


HTTP-Digest security request 


7.2.0 


CT-36 


CP-070291 


C6-070317 


0048 


- 


A 


Correction of coding of home network domain name in EF- 
DOMAIN 


7.2.0 


CT-36 


CP-070465 


- 


0050 


- 


A 


GBA NAF Keys storage policy 


7.2.0 


2007-06 


- 


- 


- 


- 


- 


MCC correction to CR0048 implementation (reference to [9]) 


7.2.1 


CT-37 


CP-070620 


C6-070418 


0051 


2 


B 


Key Establishment mechanism: alignment with TS 33.110 


7.3.0 


CT-41 


CP-080584 


C6-080416 


0055 


1 


A 


Authentication of GBA 


7.4.0 


CT-41 


CP-080585 


C6-080274 


0053 


1 


B 


Introduction of support for IMS local breakout 


8.0.0 














- correction of change history 

- correction of formatting in file structure (clause 4.3) 

- update of front cover/copyright/logos for LTE 


8.0.1 


CT-43 


CP-090453 


C6-090174 


0057 


- 


A 


IMS public user identity for emergency registration 


8.1.0 


CT-46 


CP-091011 


C6-090479 


0065 


1 


F 


References update 


8.2.0 


CT-49 


CP-1 00585 


C6-1 00401 


0066 


2 


F 


Introduction of a DF_TELECOM EF to support Public Service 
Identity for SMS over IP 


8.3.0 
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